Add a way to specify your own CA instead of using the one from the system. Much like the "+tls-ca" option to dig.